U.S. Treasury breached by hackers backed by foreign government

[Tutman]

Content source

https://www.reuters.com/article/us-usa-cyber-amazon-com-exclsuive-idUSKBN28N0PG

WASHINGTON (Reuters) - Hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury Department and an agency that decides internet and telecommunications policy, according to people familiar with the matter.

 

[oldschool]

By David E. Sanger

• Dec. 13, 2020Updated 6:54 p.m. ET

The Trump administration acknowledged on Sunday that hackers acting on behalf of a foreign government — almost certainly a Russian intelligence agency, according to federal and private experts — broke into a range of key government networks, including in the Treasury and Commerce Departments, and had free access to their email systems. Officials said a hunt was on to determine if other parts of the government had been victimized by what looked to be one of the most sophisticated, and perhaps among the largest, attacks on federal systems in the past five years. Several said a series of national security-related agencies were also affected, though it was not clear whether the systems contained highly classified material. In public, the Trump administration said little about the hack, which suggested that while the government was worried about Russian intervention in the 2020 election, key agencies working for the administration — and unrelated to the election — were actually the subject of a sophisticated attack that they were unaware of until recent weeks.
“The United States government is aware of these reports, and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” John Ullyot, the spokesman for the National Security Council, said in a statement. The Commerce Department acknowledged that one of its agencies had been targeted, without naming it, and the Department of Homeland Security’s cybersecurity agency, whose leader was fired by President Trump last month for declaring there had been no widespread election fraud, said in a statement that it had been called in as well.
The motive for the attack on the Treasury and Commerce Departments remains elusive, two people familiar with the matter said. One government official said it was too soon to tell how damaging the recent attacks were and how much material was lost. Reuters earlier reported the breach.
The revelation came less than a week after the National Security Agency, which is responsible for both breaking into foreign computer networks and defending the federal government’s most sensitive national security systems, issued a warning that “Russian state-sponsored actors” were exploiting flaws in a system that is broadly used in the federal government. At the time, the N.S.A. refused to give further details of what prompted the urgent warning. Shortly afterward, FireEye, a leading cybersecurity firm, announced that hackers working for a state had stolen some of its prized tools for finding vulnerabilities in its clients’ systems, including the federal government’s. That investigation also pointed toward S.V.R., one of Russia’s leading intelligence agencies.

If the Russia connection is confirmed, it will be the most sophisticated known theft of American government data by Moscow since a two-year spree in 2014 and 2015 in which Russian intelligence agencies gained access to the unclassified email systems at the White House, the State Department and the Joint Chiefs of Staff. It took years to undo the damage, but President Barack Obama decided at the time not to name the Russians as the perpetrators — a move that many in his administration now regard as a mistake. Emboldened, the same group of hackers went on to hack the systems of the Democratic National Committee and top officials in Hillary Clinton’s campaign, touching off investigations and fears that permeated the 2020 contest.

“There appear to be many victims of this campaign, in government as well as the private sector,” said Dmitri Alperovitch, the chairman of Silverado Policy Accelerator, a geopolitical think tank, who was the co-founder of CrowdStrike, a cybersecurity firm that helped find the Russians in the Democratic National Committee systems four years ago. “Not unlike what we had seen in 2014-2015 from this actor, when they ran a massive campaign and successfully compromised numerous victims.”
According to private-sector investigators, the attacks on FireEye led to a broader hunt to discover where else the Russian hackers might have been able to infiltrate federal and private networks. FireEye provided some key pieces of computer code to the N.S.A. and to Microsoft, officials said, which went hunting for similar attacks on federal systems. That led to the emergency warning last week.
Most hacks involve stealing user names and passwords, but this was far more sophisticated. It involved the creation of counterfeit tokens, essentially electronic indicators that provide an assurance to Microsoft or Google about the identity of the computer system its email systems are talking to. By using a flaw that is extraordinarily difficult to detect, the hackers were able to trick the system and gain access.
Reporting was contributed by Alan Rappeport, Maggie Haberman, Julian Barnes and Zolan Kanno-Youngs.

 

[oldschool]

Oops! Things are looking pretty bad on the infrastructure security front!

 

[ForgottenSeer 89360]

Hackers broke into the networks of federal agencies including the Treasury and Commerce departments in attacks revealed just days after U.S. officials warned that cyber actors linked to the Russian government were exploiting vulnerabilities to target sensitive data.

The FBI and the Department of Homeland Security's cybersecurity arm are investigating what experts and former officials said appeared to be a large-scale penetration of U.S. government agencies.

US Agencies Hacked in Monthslong Global Cyberspying Campaign

Hackers broke into the networks of the Treasury and Commerce departments as part of a global cyberespionage campaign revealed just days after a leading cybersecurity firm said it had been breached in an attack that industry experts said bore the hallmarks of Russian tradecraft.

www.nbcboston.com

 

[Gandalf_The_Grey]

Microsoft denies “evidence of successful attack” against their platform:

We reported yesterday on allegations that Microsoft’s Microsoft 365 platform was abused by hackers to spy on the U.S. Treasury Department.

Microsoft has responded by posting a guide for admins “to find and mitigate potential malicious activity”.

They, however, denied that Microsoft’s cloud was compromised, saying:

We also want to reassure our customers that we have not identified any Microsoft product or cloud service vulnerabilities in these investigations.

They, however, confirmed that “nation-state activity at significant scale, aimed at both the government and private sector” was taking place, and warned security staff to look out for the following signs:

• An intrusion through malicious code in the SolarWinds Orion product. This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials. Microsoft Defender now has detections for these files. Also, see SolarWinds Security Advisory.
• An intruder using administrative permissions acquired through an on-premises compromise to gain access to an organization’s trusted SAML token- signing certificate. This enables them to forge SAML tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts.
• Anomalous logins using the SAML tokens created by a compromised token-signing certificate, which can be used against any on-premises resources (regardless of identity system or vendor) as well as against any cloud environment (regardless of vendor) because they have been configured to trust the certificate. Because the SAML tokens are signed with their own trusted certificate, the anomalies might be missed by the organization.
• Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application.

Microsoft noted that these elements aren’t present in every attack, but urged admins to read their full customer guidance on the recent nation-state cyberattacks here.

Microsoft denies "evidence of successful attack" against their platform - MSPoweruser

We reported yesterday on allegations that Microsoft’s Microsoft 365 platform was abused by hackers to spy on the U.S. Treasury Department. Microsoft has responded by posting a guide for admins “to find and mitigate potential malicious activity”. They, however, denied that Microsoft’s cloud was...

mspoweruser.com

Russian hackers reportedly spied on the U.S. Treasury Department by hacking Microsoft 365 - MSPoweruser

Reuters report that hackers have been spying on the email of the U.S. Treasury Department for months by breaching their installation of Microsoft 365. The hackers were able to defeat Microsoft’s platform’s authentication controls and appeared to be highly sophisticated. “This is a nation state,”...

mspoweruser.com

Important steps for customers to protect themselves from recent nation-state cyberattacks - Microsoft On the Issues

Today, Microsoft is sharing information and issuing guidance about increased activities from a sophisticated threat actor that is focused on high value targets such as government agencies and cybersecurity companies. We believe this is nation-state activity at significant scale, aimed at both...

blogs.microsoft.com

/blog/2020/12/customer-guidance-on-recent-nation-state-cyber-attacks/

msrc-blog.microsoft.com

 

[Venustus]

https://www.washingtonpost.com/national-security/dhs-is-third-federal-agency-hacked-in-major-russian-cyberespionage-campaign/2020/12/14/41f8fc98-3e3c-11eb-8bc0-ae155bee4aff_story.html

 

[upnorth]

Two Silicon Valley VC firms, Silver Lake and Thoma Bravo, sold hundreds of millions of dollars in SolarWinds shares just days before the software biz emerged at the center of a massive hacking campaign. Silver Lake and Thoma Bravo deny anything untoward.

SolarWinds’ shares drop 22 per cent. But what’s this? $286m in stock sales just before hack announced?

VC firms say they weren't aware Orion code had been backdoored

www.theregister.com

 

[ForgottenSeer 89360]

I believe 2020 is the most challenging and dynamic year in terms of cyber security. We weren’t ready for all that.

 

[silversurfer]

Ensuring customers are protected from Solorigate | Microsoft Security Blog

UPDATE: Microsoft continues to work with partners and customers to expand our knowledge of the threat actor behind the nation-state cyberattacks that compromised the supply chain of SolarWinds and impacted multiple other organizations. Microsoft previously used ‘Solorigate’ as the primary...

www.microsoft.com

Starting on Wednesday, December 16 at 8:00 AM PST, Microsoft Defender Antivirus will begin blocking the known malicious SolarWinds binaries. This will quarantine the binary even if the process is running. We also realize this is a server product running in customer environments, so it may not be simple to remove the product from service. Nevertheless, Microsoft continues to recommend that customers isolate and investigate these devices:

1. Immediately isolate the affected device. If malicious code has been launched, it is likely that the device is under complete attacker control.
2. Identify the accounts that have been used on the affected device and consider these accounts compromised. Reset passwords or decommission the accounts.
3. Investigate how the affected endpoint might have been compromised.
4. Investigate the device timeline for indications of lateral movement activities using one of the compromised accounts. Check for additional tools that attackers might have dropped to enable credential access, lateral movement, and other attack activities.

 

[MacDefender]

I believe 2020 is the most challenging and dynamic year in terms of cyber security. We weren’t ready for all that.

Yeah I have to say, the sudden work from home shift has wreaked havoc on everything security. Not just losing the ability to protect employees with on site equipment but the massive demand in the VPN realm has left a lot of us without much choice but to turn down security features to increase capacity

it’s not even a matter of money. Some of the networking hardware we need are just perpetually out of stock

 

[ForgottenSeer 58943]

Why do you think I exited Cybersecurity entirely? Not that I am any great oracle, but I kept raising alarms and nobody would listen. I kept finding update channel compromises, nobody would listen. I kept finding massive breaches and compromises to the point I realized that almost everything is basically compromised at this time and it's probably better for me to start a move back to a pad of paper and a pen and to make darn sure my livelihood isn't anywhere near this nonsense..

Solarwinds compromise is vastly worse than people realize. There aren't enough qualified IT forensics and malware investigators in the world to clean all of it up. It will take years, perhaps even a decade to fully eradicate everything. Attacks implanted so many alternative, hidden pieces of malware that are latent it will be like sweeping an entire continent of unexploded bombs after WWII.

Also, I keep seeing Russia Russia Russia.. I do not believe it was Russia, but I don't want to be involved in any of this so I am not disclosing who I think it was based on people I have talked to in the field. Russia is a smokescreen for the true threat actor.

A few good things might come of this, honestly... For one, other major exploits and channel compromises will be discovered as a result of audits this causes. Two, people using these to harass/suppress/control humanity will slowly begin to lose access to this intelligence treasure trove. Third, everyone might start to reconsider what should and shouldn't be connected over the internet. Fourth and finally, this has major implications for AI/ML systems and their security, and will likely cause players in those fields to question their datasets and whether or not if they really want to remove the human out of the equation going forward.

Even Symantec didn't escape clean on this one...

SolarWinds Customers

 

[ForgottenSeer 89360]

A moment of reckoning: the need for a strong and global cybersecurity response - Microsoft On the Issues

The recent spate of cyberattacks require the government and the tech sector in the United States to look with clear eyes at the growing threats we face. At Microsoft, we are committed to being at the forefront of these efforts.

blogs.microsoft.com

 

[Lenny_Fox]

Placing backdoors in infrastructure maintenance software is an effective way to get access to an infrastructure. Imagine having a backdoor in a single signon system, what a joy would that be for spies.

US and EU don't trust foreign routers (Huawei) and security software (Kaspersky). But infrastructure management software can also be considered a critical component of the management chain of infrastructure.

To what point will the the management and control chain of critical infrastructure be regarded as critical themselves. Interesting how this story will evolve. This incident might be the trigger of a change in our views on hard en software of critical infrastructure.

Interesting posts and views shared in this thread

 

[Digmor Crusher]

Additional proof to what I always say, eventually, everything will be hacked, banks, IRS, etc. Everyone's information will be out there somewhere if it isn't already.

 

[ForgottenSeer 58943]

Placing backdoors in infrastructure maintenance software is an effective way to get access to an infrastructure. Imagine having a backdoor in a single signon system, what a joy would that be for spies.

US and EU don't trust foreign routers (Huawei) and security software (Kaspersky). But infrastructure management software can also be considered a critical component of the management chain of infrastructure.

To what point will the the management and control chain of critical infrastructure be regarded as critical themselves. Interesting how this story will evolve. This incident might be the trigger of a change in our views on hard en software of critical infrastructure.

Interesting posts and views shared in this thread

It's worse. The compromise actually impacted people with high levels of access. The admins, the IT Engineers, the Infrastructure engineers, the cybersecurity engineers. Their creds were implicated and those creds are universally domain admin permission based creds. So the keys to the castle were not only lost, but the attacker was given access to create their own keys to the castle.

Imagine a system with a large AD pool, of say 100,000 accounts. Some are this large, and larger. Even a smaller firm can have an AD of thousands of accounts. With this backdoor an attacker could create unlimited numbers of domain admin accounts well hidden among the haystack of normal users. We are talking thousands upon thousands of hours of audit will be necessary (at each firm) for just that aspect of this exploit/hack, and that's only one aspect. In the case of military/govt? They'll never have enough time or money to eradicate this and secure their systems. This is a game changer...

In addition to the AD/Role tampering, the attacker got access to domain admin creds to make hidden system changes, install additional malware, and to even plant firmware malware.

Not to sound dramatic, but when we ran into any compromise even close to this if often required us re-build an entire infrastructure in the lab, transport all of the new hardware/software to the location. Cut off the existing equipment, pull it, then cut and run on the new gear/software and spend thousands of man hours piecing everything back together. These entire federal/military/corporate networks are likely going to have to be completely replaced - that's not just new hardware, but it's also new software and some very very expensive software. (like cals from microsoft)

Anyone in IT with any advanced knowledge/experience/certs should have known Solarwinds was a hideous idea. A few reasons, and some of them frivolous.. But the very second their update server was revealed to have SolarWinds123 by ALL of the companies/govt using it, should have been pretty obvious the entire SolarWinds offering has a massive threat surface.

Additional proof to what I always say, eventually, everything will be hacked, banks, IRS, etc. Everyone's information will be out there somewhere if it isn't already.

All of it already is IMO. Only two - those that are hacked and don't know it, those that are hacked and know it.

 

[Lenny_Fox]

Anyone in IT with any advanced knowledge/experience/certs should have known Solarwinds was a hideous idea.

I looked at their website, what is so hideous about their service offering? It looks a pretty sophisticated network management solution.

Even while stock value dropped yesterday with nearly 20 percent, 7 out of 10 stock market analist still value Solarwinds a buy, 1 a hold and only two giving it a sell advice, while even the wall street journal reports that the hack was probably undetected for months (so the analists know of this breach). For fun let me ask you what is your take on this stock market madness?

I understand what you are posting. When I understand your post correctly, the correct thing to do would be to take the network and hardware offline and rebuild it with a clean sheet. Experts expect it to take months before the malicious code is removed/purged from the infrastructure.

What I don't understand is how they will remove the malicious code while keeping the network operational. In Dutch we have a saying "reconstruct while keeping the store open for business". Given the fluid characteristics of software flowing over networks, how are they going to remove the code while keeping the network in the air?

/L

 

[paulderdash]

Would love to know @cruelsister's take on this one.
And we thought the Ccleaner hack was quite big!
I would imagine it is realistically nigh impossible to recover from this hack.

 

[plat]

Microsoft denies “evidence of successful attack” against their platform:

More about this from Bleeping Computer:

 

[ForgottenSeer 89360]

More about this from Bleeping Computer:

I don't think they have attacked Microsoft successfully. If they did, they could unleash a whole new scale of unseen havoc. Most likely they have only been breached.
Trend Micro's security predictions that 2020 will be "misconfigured, complex and exposed" are the very truth unfortunately. #SolarWind123

The New Norm: Trend Micro Security Predictions for 2020 - Security Predictions

Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.

www.trendmicro.com

 

[Solarquest]

Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers | Microsoft Security Blog

We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we...

www.microsoft.com